{"id":"EUVD-2026-98689","revision":"08b3696e2ef2428bbfca99c91b2322f5","records":[{"revision":"08b3696e2ef2428bbfca99c91b2322f5","observedAt":"2026-11-07T14:29:22.968+00:00","statement":{"source":"euvd","id":"EUVD-2026-98689","aliases":["CVE-2026-77362","GHSA-43r2-c7g8-prc8"],"title":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group…","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8","https://github.com/The-40-Thieves/obsidian-tc/pull/75","https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309","https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98689","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 13, 2026, 2:00:11 PM","dateUpdated":"Oct 13, 2026, 2:50:19 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-98689","identifiers":["EUVD-2026-98689","CVE-2026-77362","GHSA-43r2-c7g8-prc8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}